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additional payment due, or to credit any overpayment, to Deposit Account No. 50- 
1417. 

(B) ALL CLAIMS ARE DIRECTED TO A SINGLE INVENTION 

Claims 1-13 are pending in the application. All the pending claims of the 
application are directed to a single invention. If the Office determines that all claims 
in the application are not directed to a single invention, Applicant will make election 
without traverse as a prerequisite to the grant of special status. 

The claimed invention, as embodied in independent claims 1 and 9-13 is 
generally directed to facilitating LUN masking and the configuration of a VLAN in a 
system having a storage device. Under claim 1, the invention is a management 
apparatus for managing a storage network having a computer, a storage device and 
a switch, comprising: a controller, an interface connected to said switch and an input 
interface to be used by an administrator, wherein when said computer or said 
storage device is connected to said switch: based on information of first and second 
identifiers of said computer or said storage device acquired via said interface from 
said computer or said storage device connected to said switch, information of a 
correspondence relation acquired from said switch via said interface between said 
second identifier of said computer or said storage device connected to said switch, 
and a third identifier for identifying an interface of said switch connected to said 
computer or said storage device, and information regarding said first identifier for 
identifying said computer or said storage device constituting a predetermined group 
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entered by said administrator via said input interface, said third identifier of said 
switch belonging to said predetermined group is specified; and in response to 
inputting of information of a storage area of said storage device and information 
regarding said first identifier of said computer which can use said storage area, from 
said input interface, the input information is sent to said storage device to instruct 
security configuration, information of said third identifier of said switch corresponding 
to said first identifier and information of said predetermined group to which said third 
identifier belongs is derived, and the derived information is sent to said switch to 
instruct configuration of a virtual LAN corresponding to said predetermined group. 

Additionally, under independent claim 9, the invention is a switch connectable 
to a computer and a storage device, comprising: a controller, an interface connected 
to said storage device or said computer and an input interface to be used by an 
administrator, wherein when said computer or said storage device is connected to 
said interface: in accordance with information of first and second identifiers of said 
computer or said storage device acquired via said interface from said computer or 
said storage device connected, information of a correspondence relation possessed 
by said switch between said second identifier of said computer or said storage 
device connected to said switch, and a third identifier for identifying an interface of 
said switch connected to said computer or said storage device, and information 
regarding said first identifier for identifying said computer or said storage device 
constituting a predetermined group entered by said administrator via said input 
interface, said controller identifies said third identifier corresponding to said computer 
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or said storage device belonging to said predetermined group; and in response to 
inputting of information of a storage area of said storage device and information 
regarding said first identifier of said computer which can use said storage area, from 
said input interface, input information is sent to said storage device to instruct 
security configuration, information of said third identifier corresponding to said first 
identifier and information of said predetermined group to which said third identifier 
belongs is derived, a virtual LAN corresponding to said predetermined group is 
configured. 

Furthermore, under independent claim 10, the invention is a storage device 
connectable to a switch connected to a computer, comprising: a controller, an 
interface connected to said switch, an input interface to be used by an administrator 
and a storage area, wherein when said computer is connected to said switch: based 
on information of first and second identifiers of said computer acquired via said 
interface from said computer connected, information of a correspondence relation 
acquired from said switch via said interface between said second identifier of said 
computer connected to said switch and a third identifier for identifying said interface 
of said switch connected to said computer, and information regarding said first 
identifier for identifying said computer constituting a predetermined group entered by 
said administrator via said input interface, said third identifier corresponding to said 
computer belonging to said predetermined group is identified; and in response to 
inputting of information of said storage area and information regarding said first 
identifier of said computer which can use said storage area, from said input interface, 
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security configuration is performed, information of said third identifier corresponding 
to said first identifier and information of said predetermined group to which said third 
identifier belongs is derived, and said switch is instructed to configure a virtual LAN 
corresponding to said predetermined group. 

In addition, under independent claim 11, the invention is a management 
method for managing a storage network having a computer, a storage device and a 
switch, comprising the steps of: when said computer or said storage device is 
connected to said switch: based on information of first and second identifiers of said 
computer or said storage device acquired from said computer or said storage device 
connected to said switch, information of a correspondence relation acquired from 
said switch between said second identifier of said computer or said storage device 
connected to said switch, and a third identifier for identifying an interface of said 
switch connected to said computer or said storage device, and information regarding 
said first identifier for identifying said computer and said storage device constituting a 
predetermined group, specifying said third identifier corresponding to said computer 
or said storage device belonging to said predetermined group; and based on 
information of a storage area of said storage device and information regarding said 
first identifier of said computer which can use said storage area, performing security 
configuration by said storage device, extracting information of said third identifier 
corresponding to said first identifier and information of said predetermined group to 
which said third identifier belongs, and creating through said switch a virtual LAN 
corresponding to said predetermined group. 
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Also, under independent claim 12, the invention is a management method for 
a storage system having a storage device, a switch and a computer respectively 
connected by a network, comprising the steps of: based on an identifier of a storage 
area of said storage device and a first address of said computer, performing access 
control configuration relative to the identifier of said storage area for said storage 
device; and converting the first address of said computer into a second address, 
converting the second address of said computer into an identifier of a port of said 
switch connected to said computer, and adding the identifier of said port to a virtual 
LAN for said switch. 

Finally, under independent claim 13, the invention is a management method 
for a storage system having a storage device, a switch and a computer respectively 
connected by a network, comprising the steps of: based on an identifier of a storage 
area of said storage device and a first address of said computer, performing access 
control configuration for said computer relative to said storage area by said storage 
device; and converting the first address of said computer into a second address, 
converting the second address of said computer into an identifier of a port of said 
switch connected to said computer, and adding the identifier of said port to a virtual 
LAN for said switch. 
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(gj PRE-EXAMINATION SEARCH 

A careful and thorough pre-examination search has been conducted, directed 
to the invention as claimed. The pre-examination search was conducted in the 
following US Manual of Classification areas: 



Additionally, a keyword search was conducted on the USPTO's EAST 
database, including US patents, published US patent applications, and the European 
and Japanese patent abstract databases. Additional searches for relevant art were 
conducted on the European Patent Office's ESPACENET database and the 
Association for Computing Machinery databases. 

(D) DOCUMENTS DEVELOPED BY THE PRE-EXAMINATION SEARCH AND 
OTHER ART OF RECORD IN THE CASE 

The documents located by the pre-examination search are listed below. 
These documents were made of record in the present application by the Information 
Disclosure Statements filed April 1 , 2005 and October 31 , 2003. 



Class 

709 



Subclass 

217, 218, 220, 222, 
223, 225, 230, 250 



US 20030069972 
US 20030085914 
US 20030101239 
US 20030131105 
US 20030229690 



Document No. 



Inventor 

Yoshimura, Yutaka et al. 
Takaoka, Nobumitsu et al. 
Ishizaki, Takeshi 
Czeiger, Moshe et al. 
Kitani, Makoto et al. 
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Additionally, the following documents were made of record in the present 
application by the Information Disclosure Statements filed October 31, 2003, and 
September 19, 2003. 



Because all of the above-listed documents are already of record in the present 
application, in accordance with MPEP § 708.02(VIII)(D), additional copies of these 
documents have not been submitted with this Petition. 

(E) DETAILED DISCUSSION OF THE REFERENCES 

Those of the above-listed documents deemed to be most closely-related to 
the present matter encompassed by the claims are discussed below, pointing out, 
with the particularity required by 37 CFR 1.111 (b) and (c), how the claimed present 
matter is patentable over the teachings of these documents. 

1 . Discussion of the Invention 

The present invention relates to facilitating LUN masking and the configuration 
of a VLAN in a system having a storage device connected to a network and at least 
one computer. (See, e.g., the specification of the present application at page 10, line 
18, through page 11, line 11.) A feature of the invention, as set forth in independent 
claims 1, 9 and 10, resides in that, in response to inputting of information of a 



Document No. 

US 20030085914 



Inventor 

Takaoka, Nobumitsu et al. 
Takaoka, Nobumitsu et al. 
Abe, Michiko 



JP 2003-141055 
JP 2001-53776 
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storage area of the storage device, and information regarding the first identifier of the 
computer which can use the storage area, the input information is sent to the storage 
device to instruct security configuration, information of the third identifier 
corresponding to the first identifier and information of the predetermined group to 
which the third identifier belongs is derived, and a virtual LAN corresponding to the 
predetermined group is configured. 

Similarly, as set forth in claim 1 1 , a feature of the invention includes the steps 
of, based on information of a storage area of the storage device and information 
regarding the first identifier of the computer which can use the storage area, 
performing security configuration by the storage device, extracting information of the 
third identifier corresponding to the first identifier and information of the 
predetermined group to which the third identifier belongs, and creating through the 
switch a virtual LAN corresponding to the predetermined group. 

Further, as set forth in claims 12 and 13, a feature of the invention is a 
management method for a storage system including the steps of, based on an 
identifier of a storage area of the storage device and a first address of the computer, 
performing access control configuration for the storage device; and converting the 
first address of the computer into a second address, converting the second address 
of the computer into an identifier of a port of the switch connected to the computer, 
and adding the identifier of the port to a virtual LAN for the switch. The prior art does 
not teach or suggest these features in combination with the other limitations of claims 
1 and 9-13. 
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2. Discussion of the References Believed to be Most-Closely Related 

Published US Patent Application No. US 20030069972, to Yoshimura et al., 
shows a computer resource allocating method that includes preparing a user 
identification table, VPN, VLAN, and storage network configuration definition tables 
that are managed by a managing server. User-dedicated VLANs are configured for 
each user, and may include the allocation of servers and LUNs. The load of each of 
server is monitored and an allocation change, such as a dynamic change of the 
VLAN, may be made based upon the monitored load. (See, e.g., Abstract, 
paragraphs 10-12 and 48-66.) Thus, Yoshimura is concerned with allocating 
resources, and does not teach the present invention in which input information is 
sent to a storage device to instruct security configuration, and derived information is 
sent to a switch to instruct configuration of a virtual l_AN. Accordingly, Yoshimura 
does not teach that, in response to inputting of information of a storage area of the 
storage device, and information regarding the first identifier of the computer which 
can use the storage area, the input information is sent to the storage device to 
instruct security configuration, and information of the third identifier corresponding to 
the first identifier and information of the predetermined group to which the third 
identifier belongs is derived, a virtual LAN corresponding to the predetermined group 
is configured, as set forth in claims 1 , 9, and 10. Neither does Yoshimura teach a 
method that includes the steps of, based on information of a storage area of the 
storage device and information regarding the first identifier of the computer which 
can use the storage area, performing security configuration by the storage device, 
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extracting information of the third identifier corresponding to the first identifier and 
information of the predetermined group to which the third identifier belongs, and 
creating through the switch a virtual LAN corresponding to the predetermined group, 
as set forth in claim 11. Further, Yoshimura does not teach a management method 
for a storage system including the steps of, based on an identifier of a storage area 
of the storage device and a first address of the computer, performing access control 
configuration for the storage device; and converting the first address of the computer 
into a second address, converting the second address of the computer into an 
identifier of a port of the switch connected to the computer, and adding the identifier 
of the port to a virtual LAN for the switch, as set forth in claims 12 and 13. 

Published US Patent Application No. US 20030085914, to Takaoka et al., (US 
equivalent of JP 2003-141055) shows a storage network in which access restriction 
methods are applied. A utility program includes a display for verifying the 
relationship of connections between a switch unit, storage devices, and computers. 
The system includes a management computer with a console, a storage device 
having an LUN security function, a fabric switch, and a computer using the storage 
device. (See, e.g., Abstract, and paragraphs 14-17 and 46-67.) Thus, Takaoka is 
directed to the display, management, and possible reconfiguration of states of 
connections between computers and storage means, such as the setting of an LUN 
security configuration, but Takaoka does not teach the present invention, including 
how to configure a VLAN in conjunction with security configuration of a storage 
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device. Accordingly, Takaoka does not teach that, in response to inputting of 
information of a storage area of the storage device, and information regarding the 
first identifier of the computer which can use the storage area, the input information 
is sent to the storage device to instruct security configuration, and information of the 
third identifier corresponding to the first identifier and information of the 
predetermined group to which the third identifier belongs is derived, a virtual LAN 
corresponding to the predetermined group is configured, as set forth in claims 1, 9, 
and 10. Neither does Takaoka teach a method that includes the steps of, based on 
information of a storage area of the storage device and information regarding the first 
identifier of the computer which can use the storage area, performing security 
configuration by the storage device, extracting information of the third identifier 
corresponding to the first identifier and information of the predetermined group to 
which the third identifier belongs, and creating through the switch a virtual LAN 
corresponding to the predetermined group, as set forth in claim 1 1 . Further, 
Takaoka does not teach a management method for a storage system including the 
steps of, based on an identifier of a storage area of the storage device and a first 
address of the computer, performing access control configuration for the storage 
device; and converting the first address of the computer into a second address, 
converting the second address of the computer into an identifier of a port of the 
switch connected to the computer, and adding the identifier of the port to a virtual 
LAN for the switch, as set forth in claims 12 and 13. 
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Published US Patent Application No. US 20030101239, to Ishizaki, shows 
secure IP-protocol-capable storage devices with VLAN support. A storage controller 
is coupled with at least one of a plurality of storage devices. A network interface 
connectable to a VLAN switch provides connectivity. The storage apparatus is 
operable to control the VLAN switch to map at least one of a plurality of segments of 
a VLAN to at least one of a plurality of virtual volumes of the storage devices based 
upon configuration information. In specific embodiments, the VLAN access links 
may be identified by MAC address. Additionally, the method can include updating a 
physical network IP address, updating a VLAN interface IP address and VLAN tag, 
deleting a designated VLAN interface, and adding a new VLAN interface. (See, e.g., 
Abstract and paragraphs 5-18 and 63-86.) Thus, while Ishizaki teaches a method 
and apparatus for a VLAN, including a VLAN switch and a secure storage apparatus, 
Ishizaki does not teach configuring a secure storage device in response to inputting 
of information of a storage area of the storage device and information regarding a 
first identifier of a computer which can use the storage area, as taught by the present 
invention. Accordingly, Ishizaki does not teach that, in response to inputting of 
information of a storage area of the storage device, and information regarding the 
first identifier of the computer which can use the storage area, the input information 
is sent to the storage device to instruct security configuration, and information of the 
third identifier corresponding to the first identifier and information of the 
predetermined group to which the third identifier belongs is derived, a virtual LAN 
corresponding to the predetermined group is configured, as set forth in claims 1, 9, 
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and 10. Neither does Ishizaki teach a method that includes the steps of, based on 
information of a storage area of the storage device and information regarding the first 
identifier of the computer which can use the storage area, performing security 
configuration by the storage device, extracting information of the third identifier 
corresponding to the first identifier and information of the predetermined group to 
which the third identifier belongs, and creating through the switch a virtual LAN 
corresponding to the predetermined group, as set forth in claim 1 1 . Further, Ishizaki 
does not teach a management method for a storage system including the steps of, 
based on an identifier of a storage area of the storage device and a first address of 
the computer, performing access control configuration for the storage device; and 
converting the first address of the computer into a second address, converting the 
second address of the computer into an identifier of a port of the switch connected to 
the computer, and adding the identifier of the port to a virtual LAN for the switch, as 
set forth in claims 12 and 13. 

Published US Patent Application No. US 20030131 105, to Czeiger etaL, 
shows a method for transferring information between a first network operating under 
Ethernet protocol and a second network operating under a Fibre Channel protocol. 
The stations located in the first network are grouped into VLANs that use MAC 
identifiers for identifying source and destination addresses. (See, e.g., Abstract and 
paragraphs 10 and 57-61.) Thus, Czeiger is directed to inter-network 
communications between an FC network and an Ethernet network, and does not 
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teach the present invention, including a system or method wherein input information 
is sent to a storage device to instruct security configuration. Accordingly, Czeiger 
does not teach that, in response to inputting of information of a storage area of the 
storage device, and information regarding the first identifier of the computer which 
can use the storage area, the input information is sent to the storage device to 
instruct security configuration, and information of the third identifier corresponding to 
the first identifier and information of the predetermined group to which the third 
identifier belongs is derived, a virtual LAN corresponding to the predetermined group 
is configured, as set forth in claims 1 , 9, and 1 0. Neither does Czeiger teach a 
method that includes the steps of, based on information of a storage area of the 
storage device and information regarding the first identifier of the computer which 
can use the storage area, performing security configuration by the storage device, 
extracting information of the third identifier corresponding to the first identifier and 
information of the predetermined group to which the third identifier belongs, and 
creating through the switch a virtual LAN corresponding to the predetermined group, 
as set forth in claim 1 1 . Further, Czeiger does not teach a management method for 
a storage system including the steps of, based on an identifier of a storage area of 
the storage device and a first address of the computer, performing access control 
configuration for the storage device; and converting the first address of the computer 
into a second address, converting the second address of the computer into an 
identifier of a port of the switch connected to the computer, and adding the identifier 
of the port to a virtual LAN for the switch, as set forth in claims 12 and 13. 
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Published US Patent Application No. US 20030229690, to Kitani et al., shows 
a secure storage system for securely accessing a storage device on a network by a 
client having VPN capability. A management apparatus is included for managing the 
storage device by means of a logical volume assigned to the storage device. A 
conversion apparatus converts the protocol used for the storage device and the 
protocol used for the VPN. A mapping means is also included for storing a VPN 
allocated to the client and an access range of the storage device corresponding to 
the VPN. (See, e.g., Abstract and paragraphs 14-19 and 50-63.) However, Kitani 
does not teach a system or method wherein input information is sent to a storage 
device to instruct security configuration, as in the present invention. Accordingly, 
Kitani does not teach that, in response to inputting of information of a storage area of 
the storage device, and information regarding the first identifier of the computer 
which can use the storage area, the input information is sent to the storage device to 
instruct security configuration, and information of the third identifier corresponding to 
the first identifier and information of the predetermined group to which the third 
identifier belongs is derived, a virtual LAN corresponding to the predetermined group 
is configured, as set forth in claims 1, 9, and 10. Neither does Kitani teach a method 
that includes the steps of, based on information of a storage area of the storage 
device and information regarding the first identifier of the computer which can use 
the storage area, performing security configuration by the storage device, extracting 
information of the third identifier corresponding to the first identifier and information of 
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the predetermined group to which the third identifier belongs, and creating through 
the switch a virtual LAN corresponding to the predetermined group, as set forth in 
claim 1 1 . Further, Kitani does not teach a management method for a storage system 
including the steps of, based on an identifier of a storage area of the storage device 
and a first address of the computer, performing access control configuration for the 
storage device; and converting the first address of the computer into a second 
address, converting the second address of the computer into an identifier of a port of 
the switch connected to the computer, and adding the identifier of the port to a virtual 
LAN for the switch, as set forth in claims 12 and 13. 

The Japanese patent to Abe, JP 2001-53776, as also discussed in the 
specification of the present application at page 3, shows a network system that does 
not require that a VLAN definition be changed when a terminal device is moved, 
added or eliminated. When a terminal device is moved from a first switch to a 
second switch, the second switch detects that the terminal device is not registered 
for the second switch. The second switch inquires a server and receives a frame 
transmitted from terminal device. The second switch compares the received frame 
with a VLAN definition table. The server detects that the terminal device was moved 
from the first switch and the VU\N belonging there is detected and the result is 
imparted to the second switch. The second switch receives the results and changes 
its VLAN definition table to register the terminal device. Thus, Abe discloses a 
method to automatically reconfigure a VLAN when a switch to which a computer is 
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connected is changed. However, Abe does not teach a system by which a VLAN 
may be configured when a storage system is configured for security in the system. 
Accordingly, Abe does not teach that, in response to inputting of information of a 
storage area of the storage device, and information regarding the first identifier of the 
computer which can use the storage area, the input information is sent to the storage 
device to instruct security configuration, and information of the third identifier 
corresponding to the first identifier and information of the predetermined group to 
which the third identifier belongs is derived, a virtual LAN corresponding to the 
predetermined group is configured, as set forth in claims 1, 9, and 10. Neither does 
Abe teach a method that includes the steps of, based on information of a storage 
area of the storage device and information regarding the first identifier of the 
computer which can use the storage area, performing security configuration by the 
storage device, extracting information of the third identifier corresponding to the first 
identifier and information of the predetermined group to which the third identifier 
belongs, and creating through the switch a virtual LAN corresponding to the 
predetermined group, as set forth in claim 1 1 . Further, Abe does not teach a 
management method for a storage system including the steps of, based on an 
identifier of a storage area of the storage device and a first address of the computer, 
performing access control configuration for the storage device; and converting the 
first address of the computer into a second address, converting the second address 
of the computer into an identifier of a port of the switch connected to the computer, 
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and adding the identifier of the port to a virtual LAN for the switch, as set forth in 
claims 12 and 13. 

CONCLUSION 

Thus, from the foregoing, it is apparent that none of the above-discussed 
documents teach the storage system of the invention, including that, in response to 
inputting of information of a storage area of the storage device, and information 
regarding the first identifier of the computer which can use the storage area, the input 
information is sent to the storage device to instruct security configuration, information 
of the third identifier corresponding to the first identifier and information of the 
predetermined group to which the third identifier belongs is derived, a virtual LAN 
corresponding to the predetermined group is configured, as set forth in claims 1, 9, 
and 10. Nor do the above-discussed documents teach the steps of, based on 
information of a storage area of the storage device and information regarding the first 
identifier of the computer which can use the storage area, performing security 
configuration by the storage device, extracting information of the third identifier 
corresponding to the first identifier and information of the predetermined group to 
which the third identifier belongs, and creating through the switch a virtual LAN 
corresponding to the predetermined group, as set forth in claim 1 1 . Neither do the 
above-discussed documents teach a management method for a storage system 
including the steps of, based on an identifier of a storage area of the storage device 
and a first address of the computer, performing access control configuration for the 
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storage device; and converting the first address of the computer into a second 
address, converting the second address of the computer into an identifier of a port of 
the switch connected to the computer, and adding the identifier of the port to a virtual 
LAN for the switch, as set forth in claims 12 and 13. Accordingly, independent 
claims 1 and 9-13 are patentable over the above-listed documents. 

The Applicants submit that the foregoing discussion demonstrates the 
patentability of the independent claims over the closest-known prior art, taken either 
singly, or in combination. The remaining claims depend from the independent 
claims, claim additional features of the invention, and are patentable at least 
because they depend from allowable base claims. Accordingly, the requirements of 
37 CFR §1. 102(d) having been satisfied, the Applicants request that this Petition to 
Make Special be granted and that the application be examined according to 
prescribed procedures set forth in MPEP §708.02 (VIII). 

The Applicants prepared this Petition in order to satisfy the requirements of 37 
C.F.R. §1. 102(d) and MPEP §708.02 (VIII). The pre-examination search required by 
these sections was "directed to the invention as claimed in the application for which 
special status is requested." MPEP §708.02 (VIII). The search performed in support 
of this Petition is believed to be in full compliance with the requirements of MPEP 
§708.02 (VIM); however, Applicants make no representation that the search covered 
every conceivable search area that might contain relevant prior art. It is always 
possible that prior art of greater relevance to the claims may exist. The Applicants 
urge the Examiner to conduct his or her own complete search of the prior art, and to 
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thoroughly examine this application in view of the prior art cited above and any other 
prior art that may be located by the Examiner's independent search. 

Further, while the Applicants have identified and discussed certain portions of 
each cited reference in order to satisfy the requirement for a "detailed discussion of 
the references, which discussion points out, with the particularly required by 37 
C.F.R. §1.1 11(b) and (c), how the claimed present matter is patentable over the 
references" (MPEP §708.02(VIII)), the Examiner should not limit review of these 
documents to the identified portions, but rather is urged to review and consider the 
entirety of each reference. 
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